{"schemaVersion":3,"id":"CVE-2026-76985","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came.\n\nAn application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected.\n\nAs a workaround, escape the values in the override.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.","dates":{"published":"2026-08-31T13:22:18.540Z","modified":"2026-08-31T14:21:50.678Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.1,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Green","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.1,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00505,"percentile":0.41843,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.00899999999999998,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00496},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00505,"percentile":0.41843}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00505,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00505,"percentile":0.41843}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"apache software foundation","product":"apache wicket","name":"Apache Wicket","label":"apache wicket","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.0, ≤ 8.18.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, ≤ 9.23.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, ≤ 10.10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, ≤ 8.18.0 | ≥ 9.0.0, ≤ 9.23.0 | ≥ 10.0.0, ≤ 10.10.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_wicket"},{"vendor":"apache","product":"wicket","name":"wicket","label":"wicket","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.0, < 8.19.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.24.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, < 10.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.19.0 | ≥ 9.0.0, < 9.24.0 | ≥ 10.0.0, < 10.11.0","eol":null,"hubHref":"/vendor/apache/wicket"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/0x2x12x22ff4yq4rhqokb2fjhtsd0f0j","label":"lists.apache.org/thread/0x2x12x22ff4yq4rhqokb2fjhtsd0f0j","hostname":"lists.apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/31/5","label":"www.openwall.com/lists/oss-security/2026/08/31/5","hostname":"www.openwall.com","tags":["Mailing List","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-31T13:22:18.540Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-31T14:21:50.678Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:34:01.347Z","stale":false,"partial":false}}